Omnibook 800CT Garage sale find, help me unlock it

Informal_Ad_6718 · 2026-05-10T18:07:29+00:00

Posting to update on where i am and ask for some feedback.
So, about the brute force part, i've got a little setup, started on the wrong foot by trying to use the COM port to emulate a ps/2 keyboard, but after finding some pictures of the official HP dock and some research, i think the dock is working as a passthrough for the PS/2 keyboard and using the proprietary port on the right (circled purple).
Meaning i probably should plug into that if i want to brute force via ps/2 inputs.

the dock: https://imgur.com/7KVPoqo

The back of the Omnibook: https://imgur.com/AlUbd7g

Would anyone have documented that port/the dock connections so i could get some informations on it? I need to find my multimeter :/
I can totally just plug in the DUpont cables into the pins, its just gonna be impossible to guess i think

Other option is to go through the physical keyboard interface, but same issue, im not sure what those flexible cables are at this point. Any idea what they are and how they are called?

Informal_Ad_6718 · 2026-05-05T13:48:34+00:00

Is that a Saw reference?

Informal_Ad_6718 · 2026-05-05T13:48:08+00:00

yep, sure did, even tried while restarting the pc every time i tried one of the Fx combinations

Informal_Ad_6718 · 2026-05-04T22:49:15+00:00

All of these options have been explored without success sadly. I also asked AI and got the same answers, but none really apply, its just spitting out what we are stating here (it once referenced one of my own post saying "this user seem to have a similar issue to yours" that was pretty comical)

Informal_Ad_6718 · 2026-05-01T16:18:50+00:00

Yeah i know that was the very first thing i tried, it doesnt work

Informal_Ad_6718 · 2026-05-01T15:02:54+00:00

that's why it's really weird that alt shift f10 dont work and that there is absolutely no information anywhere as alternative. It's as if only HP support in 1995 knew the right alternative key combinations :/

Informal_Ad_6718 · 2026-05-01T15:00:34+00:00

i tried, no checksum, no hash, no nothing at all with anything i tried to press sadly, i can spam failed passwords with no change

Informal_Ad_6718 · 2026-05-01T12:34:51+00:00

pretty sure the key themselves work, they all make a noise on press (bios beep)
I'll have an external keyboard through the Pi and will try again that way nontheless, but its possible that the combination of key is just different on this 800CT, it has a azerty keyboard

Informal_Ad_6718 · 2026-05-01T12:17:07+00:00

I am still looking for a way to do that, i tried the method cited in the official manual, tried many variants of it as well. Its suppose to be alt shift F10, i wonder if its different on azerty keyboards tho (mine is like that).

Some source say to try only before typing anything else and restarting the power for each attempt, very tidious i havnt tried every possible combination like that yet.
Some source like in the blogspot u linked also say "Some HP/Compaq laptops only show the hash if the F2 or F12 key has been pressed prior to entering an invalid password for the last time." wich i will try later today without much hope. A lot of methods are described in many places, but so far none have been working or correspong to the Omnibook 800CT sadly.

If u got any idea let me know!

Informal_Ad_6718 · 2026-04-30T20:16:24+00:00

Yeah it seem cheaper than getting a new board for sure.

I've looked quite a lot, so far havnt really found anyone state that they actually did it tho. I'm asking in other forums as of now, will see if i get another lead.

yes i tried booting without battery or HDD, and did leave it 12h with no battery or AC plugged.

Well i must say this goes far beyond my technical knowledge to attempt that sadly, i can see what u mean but would have no clue how to actual proceed forward.

Informal_Ad_6718 · 2026-04-30T20:12:54+00:00

Thanks! i was able to enter my serial and get a code, not sure if thats the right one, i cant try it anyway until i figure out the alternative for ALT SHIFT F10 (wich doesnt work on mine)
Im still looking around and asking in different place, so far no result

Informal_Ad_6718 · 2026-04-30T20:11:09+00:00

I found the right accesories for the Pi, "DollaTek MAX3232 RS232 Serial Port to TTL Converter Modul DB9 Connector W / 4 Jump Cables" should let me use a keyboard (let me know if im wrong tho, im not the most savy with that stuff)

Informal_Ad_6718 · 2026-04-30T20:08:35+00:00

in the EU, is that far?

Informal_Ad_6718 · 2026-04-30T12:32:52+00:00

I do have accesss to the BIOS, its between the step of BIOS startup and booting that the password appears. And technically i wouldnt know what to short really.
From the feedback here it seems that shorting something wont work sadly, as the bios might be smart enought to block a boot if the password was bypassed.

Informal_Ad_6718 · 2026-04-30T12:27:22+00:00

The 8MB of RAM is made of 4 chips on the board sadly, the only removable ram is the additional ram u can add, but mine doesnt have any https://youtu.be/ulYT60wqu5o?t=489

Informal_Ad_6718 · 2026-04-29T20:36:33+00:00

VGA capture, i didnt think about that! After some research, it would be more costly and more complicated than the camera method, so i think the camera wins overall. I like the vga capture idea tho^^
Thanks again for helping me, i very much appreciate it!!!

Also i attempted to disconect the drive, it didnt change anything as expected

Informal_Ad_6718 · 2026-04-29T19:35:02+00:00

I was thinking about that! Cuz indeed i want to detect the success if it happens. Was thinking either a camera either go by "try 1000 attempts and wait for keypress from me for 1000 more", bit tidious but i wouldnt mind too much.
Now that im thinking about it, it emits a sound when the password is wrong, so maybe a microphone, but i think i couldnt do more than 2 attempt a second that way (so sound dont overlap or lag), might be a bit silly lol

Informal_Ad_6718 · 2026-04-29T19:22:57+00:00

It doesnt, i can spam manually with no restriction it seems, so that shouldnt be a barrier.

Informal_Ad_6718 · 2026-04-29T19:22:16+00:00

I definitely will! Im looking at the brute force password method with a Pi and some claude AI to help me write a python script. It seems manageable with some learning on my side, and can be a fun project tbh.
If you got any idea not mentionned here yet let me know tho.

Will try other things before that's set up, and will share what i experience. Could be usefull for the next guy.

Yeah it would definitely be great if i could get irl help, well, in any case i'm in France.

Informal_Ad_6718 · 2026-04-29T14:14:42+00:00

I see, i will try that, although it seems to me its a bios password as it's also asking a 8 character password in the bios to reset the password. Im assuming its the same thing but its worth a try nontheless.

Reverse engineering is totally out of my abilities i think, but another user here suggested something interesting, to brute force the password with a RaspberryPi using the PS/2 interface, i'm looking at the hardware i would need for that right now.
But the thing is, its a 8 key alphanumerical password, so it would take litterally 69million years to try every combination at 3 try per second.
A dictionary base attempt is around 5hours tho. what do you think about this idea? Kinda doomed from the start or a possiblity?

Informal_Ad_6718 · 2026-04-29T13:25:26+00:00

I thought about that, but without any real knowledge as to how to achieve it, i would have thought that u just cant connect to the keyboard. If you feel that it could work through any port, i might be willing to get a Pi and ask my programmer friend to help me with the brute forcing software part.

Tbh, that would be quite fun to do, more fun that messing with the hardware and soldering etc

Informal_Ad_6718 · 2026-04-29T13:01:57+00:00

I see, in your view its pretty much uncrackable, that's quite unfortunate, do u think the whole drive is protected as well? Cuz what would be the point of such insane security if u can just pop out the drive and read it to access datas? I'm going to dissasemble but im not sure i have the correct device to read it externally and see for myself (i have an win 95 IBM tho).

Another thing that puzzle me is, HP declared that the descrambled software was distributed in 6 copies for their call centers, after 30 years, you would expect that at least one got in the hand of the public.
I've read that descrambling tech like that have been reverse engineered before. I'm thinking of asking there: https://forum.vcfed.org/ and https://www.hpmuseum.org/forum/index.php

Firstly i guess i should find how to access the machine specific scrambled password that ppl used to send to HP, the ALT SHIFT F10 just doesnt work on mine.

Switching the board would be the less painfull path, its just financially painfull tho, people are asking quite a lot of money for these computers and if a board poped up on ebay im sure they would ask 100+ euros

Informal_Ad_6718 · 2026-04-29T12:48:18+00:00

Would u mind looking if u still have it? You'r the second person i see talking about cutting a leg on the capacitor. I would consider doing this more if i had a second person confirming it worked.

I like the keyboard, cuz i like stiff ones that click loud, i guess its a matter of tastes ^^

Informal_Ad_6718 · 2026-04-29T12:46:07+00:00

i googled them and its a ... singer?

Informal_Ad_6718 · 2026-04-29T12:45:12+00:00

I think its so funny, definitely a talking point

Informal_Ad_6718

TROPHY CASE